AWSSupport-TroubleshootCFNCustomResource - Amazon Systems Manager Automation runbook reference
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

AWSSupport-TroubleshootCFNCustomResource

Description

The AWSSupport-TroubleshootCFNCustomResource runbook helps diagnose why an Amazon CloudFormation stack failed in creating, updating, or deleting a custom resource. The runbook checks the service token used for the custom resource and the error message that was returned. After reviewing the details for the custom resource, the runbook output provides an explanation of the stack behavior and troubleshooting steps for the custom resource.

Run this Automation (console)

Document type

Automation

Owner

Amazon

Platforms

Linux, macOS, Windows

Parameters

  • AutomationAssumeRole

    Type: String

    Description: (Optional) The Amazon Resource Name (ARN) of the Amazon Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf. If no role is specified, Systems Manager Automation uses the permissions of the user that starts this runbook.

  • StackName

    Type: String

    Description: (Required) The name of the Amazon CloudFormation stack where the custom resource failed.

Required IAM permissions

The AutomationAssumeRole parameter requires the following actions to successfully use the runbook.

  • cloudformation:DescribeStacks

  • cloudformation:DescribeStackEvents

  • cloudformation:ListStackResources

  • ec2:DescribeRouteTables

  • ec2:DescribeNatGateways

  • ec2:DescribeSecurityGroups

  • ec2:DescribeVpcs

  • ec2:DescribeVpcEndpoints

  • ec2:DescribeSubnets

  • logs:FilterLogEvents

Document Steps

  • validateCloudFormationStack - Verifies that the Amazon CloudFormation stack exists in the same Amazon Web Services account and Amazon Web Services Region.

  • checkCustomResource - Analyzes the Amazon CloudFormation stack, checks the failed custom resource, and outputs information about how to troubleshoot the failed custom resource.